Journalbeat on Kubernetes

Elastic Stack Beats
1

Dears,

I'm trying to run Journalbeat on Kubernetes cluster and almost all works fine :slight_smile:
I run pod with Privileges and access to /var/log/journal directory, so Journalbeat is reading it correctly, but....

But I want to also use Processor plugin "add_kubernetes_metadata" and journalbeat ends with error each time:

Exiting: error initializing publisher: error initializing processors: Can not initialize kubernetes plugin with zero matcher plugins

But here a config for K8s:

  processors:
      - drop_event:
          when:
            not:
              has_fields: ['container.name']

      - add_kubernetes_metadata:
          in_cluster: true

      - add_host_metadata:
          netinfo.enabled: false
          cache.ttl: 5m

Pod is run under kubernetes system namespace. I also tried to run it in "default" namespace, but always end with this error.

Any ideas? I'm doing something wrong ?

Thanks!

2

Nobody try use this ?
Anyone ?

3

Hi @przemek_danysz I had similar issue:

I made it working with the next settings:

    processors:
    - add_kubernetes_metadata:
        in_cluster: true
        default_indexers.enabled: false
        default_matchers.enabled: false
        indexers:
          - container:
        matchers:
          - fields:
              lookup_fields: ["container.id"]